Web Browsers – at each sign-in in a fresh browser session.

Office apps – a rolling window of up to 90 days (inactivity), this is renewed at each authentication until revoked.

By default, the frequency of these prompts is: The most common prompt users receive in a lot of organizations is on their primary device that is already in use.

It’s important when looking at MFA frequency to clearly understand the goal. Understanding the Role of Reauthenticating with MFA In this post I will try to simplify the many factors that influence MFA timing and provide some guidance so that we can (somewhat) predict when and how often our users will be prompted. Microsoft documentation on MFA frequency is extremely detailed but honestly not as clear as it could be. It also really shouldn’t be the case in most scenarios.

By default that isn’t the case – and has never really been the case. There is an assumption that when we enabled MFA, users should get prompted when they log in every morning. I often get asked by customers about the frequency of MFA for Office 365 / Azure AD.

Office 365 mfa